WAF rule matching method and device, medium and equipment

Abstract

The invention provides a WAF rule matching method and device, a medium and equipment. The method comprises the following steps: receiving an incoming request of a user; extracting a detection position parameter from the incoming request; determining a rule set corresponding to each detection position parameter; performing matching operation on each detection position parameter in the incoming request and a first regular matching rule in the at least one rule set corresponding to the detection position parameter to obtain an independent matching result of the detection position parameter; determining a logic processing result of each independent matching result of each detection position parameter according to a logic relation between the first regular matching rules; and determining a comprehensive matching result according to the logic processing result, and returning the comprehensive matching result to the user. According to the method, the corresponding rule set is formed for one detection position parameter, so that the number of times of rule matching can be reduced, concurrent execution of each rule set is facilitated, and the response speed is improved.

Description

Technical Field

[0001] The present invention relates to the field of security protection technology, and in particular to a WAF rule matching method, device, medium and equipment. Background Art

[0002] When a request is received, it is necessary to match the WAF rules against the request and then respond based on the matching results. However, as the number of WAF rules increases, more rules need to be matched for each incoming request, which will reduce the response speed and firewall performance. The full spelling of WAF in English is Web Application Firewall, and the Chinese is Web Application Firewall. Summary of the invention

[0003] In view of at least one of the above technical problems, an embodiment of the present invention provides a WAF rule matching method, device, medium, and equipment.

[0004] In a first aspect, a WAF rule matching method provided by an embodiment of the present invention includes:

[0005] Receive incoming requests from users;

[0006] extracting respective detection position parameters from the incoming request;

[0007] Determine the rule sets corresponding to the respective detection position parameters; wherein each detection position parameter corresponds to at least one rule set, each rule set includes at least one first regular matching rule, each first regular matching rule in each rule set corresponds to the same detection position parameter, and each first regular matching rule is a matching rule corresponding to a single detection position parameter;

[0008] Performing a matching operation on each detection position parameter in the incoming request with a first regular matching rule in the at least one rule set corresponding to the detection position parameter to obtain a separate matching result for the detection position parameter; and determining a logical processing result of each separate matching result of each detection position parameter according to a logical relationship between each first regular matching rule;

[0009] A comprehensive matching result is determined according to the logic processing result, and the comprehensive matching result is returned to the user.

[0010] In one embodiment, the process of determining the rule set includes:

[0011] Obtain a second regular matching rule; wherein the second regular matching rule is a matching rule corresponding to multiple detection position parameters;

[0012] Splitting each of the second regular matching rules to obtain first regular matching rules corresponding to each detection position parameter;

[0013] Aggregate first regular matching rules corresponding to the same detection position parameter into a first set;

[0014] Determine the minimum matching length of the regular expression of each first regular matching rule;

[0015] According to the minimum matching length of each regular expression of each first regular matching rule, each first set is divided into multiple second sets; wherein each first regular matching rule in each second set corresponds to the same detection position parameter and the same minimum matching length, and different second sets under one first set correspond to the same detection position parameter and different minimum matching lengths;

[0016] Determine whether the regular expression of each first regular matching rule needs to match special characters;

[0017] According to whether the regular expressions of each first regular matching rule need to match special characters, each second set is divided into a third set and a fourth set; wherein the third set in each second set includes each first regular matching rule in the second set that needs to match special characters; and the fourth set in each second set includes each first regular matching rule in the second set that does not need to match special characters, and the third set and the fourth set are the rule sets.

[0018] In one embodiment, the determining of the rule sets corresponding to the respective detection position parameters includes:

[0019] Determining the minimum matching length required for the incoming request and whether special characters need to be matched;

[0020] Determine a first set corresponding to each detection position parameter in the incoming request; select a second set corresponding to the minimum matching length required for the incoming request under the first set; and select the third set or the fourth set under the second set according to whether the incoming request needs to match special characters.

[0021] In one embodiment, splitting each of the second regular matching rules to obtain first regular matching rules corresponding to each detection position parameter includes:

[0022] When splitting, each first regular matching rule from the same second regular matching rule is marked, and the dependency relationship between each first regular matching rule from the same second regular matching rule is recorded;

[0023] According to the dependency relationship between the first regular matching rules from the same second regular matching rule, a logical relationship between the first regular matching rules from the same second regular matching rule is determined.

[0024] In one embodiment, performing a matching operation on each detection position parameter in the incoming request with a first regular matching rule in the at least one rule set corresponding to the detection position parameter to obtain a separate matching result for the detection position parameter includes:

[0025] The matching tasks corresponding to different rule sets are executed in parallel, and the matching tasks corresponding to the first regular matching rules in the same rule set are executed in series.

[0026] In one embodiment, the method further comprises:

[0027] Record the matching log of each incoming request; wherein the matching log includes the matching parameters carried in the incoming request, the matching results obtained after the rule matching, and the number of matches;

[0028] Cache the matching logs of each incoming request from the same site, and isolate the caches corresponding to different sites;

[0029] Correspondingly, before extracting each detection location parameter from the incoming request, the method also includes: determining whether there is a matching log corresponding to the same matching parameter in the cache corresponding to the site from which the incoming request received this time comes; if so, returning the matching result in the matching log corresponding to the same matching parameter to the user, and updating the number of matches in the matching log.

[0030] In one embodiment, the method further comprises:

[0031] According to the number of matches in the matching log in the cache corresponding to each site, the matching log in the cache corresponding to the site is eliminated and updated using the least recently used algorithm.

[0032] According to the second aspect, the WAF rule matching device provided by the embodiment of the present invention includes:

[0033] A request receiving module, used to receive incoming requests from users;

[0034] A location extraction module, used to extract various detection location parameters from the incoming request;

[0035] A set determination module, used to determine the rule sets corresponding to the respective detection position parameters; wherein each detection position parameter corresponds to at least one rule set, each rule set includes at least one first regular matching rule, each first regular matching rule in each rule set corresponds to the same detection position parameter, and each first regular matching rule is a matching rule corresponding to a single detection position parameter;

[0036] A rule matching module, used for matching each detection position parameter in the incoming request with a first regular matching rule in the at least one rule set corresponding to the detection position parameter to obtain a separate matching result of the detection position parameter; and determining a logical processing result of each separate matching result of each detection position parameter according to a logical relationship between each first regular matching rule;

[0037] The result returning module is used to determine the comprehensive matching result according to the logic processing result, and return the comprehensive matching result to the user.

[0038] According to a third aspect, an embodiment of the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed in a computer, enables the computer to execute the method provided in the first aspect.

[0039] According to a fourth aspect, an embodiment of the present invention provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, the method provided in the first aspect is implemented.

[0040] The WAF rule matching method, device, medium, and equipment provided in the embodiment of the present invention extract each detection position parameter from the incoming request, then determine the rule set corresponding to each detection position parameter, match each detection position parameter in the incoming request with the first regular matching rule in the at least one rule set corresponding to the detection position parameter, and obtain a separate matching result of the detection position parameter; determine the logical processing results of each separate matching result of each detection position parameter according to the logical relationship between each first regular matching rule, and finally determine the comprehensive matching result according to the logical processing result, and return the comprehensive matching result to the user. Since each detection position parameter corresponds to at least one rule set, each rule set includes at least one first regular matching rule, each first regular matching rule in each rule set corresponds to the same detection position parameter, and each first regular matching rule is a matching rule corresponding to a single detection position parameter. Compared with the traditional multi-position matching rule form, the embodiment of the present invention forms a corresponding rule set for one detection position parameter, which can reduce the number of rule matching times, facilitate the concurrent execution of each rule set, and improve the response speed. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] Figure 1 A flowchart of a WAF rule matching method in an embodiment of the present invention;

[0042] Figure 2 The figure is a structural block diagram of a WAF rule matching device in one embodiment of the present invention. DETAILED DESCRIPTION

[0043] In a first aspect, an embodiment of the present invention provides a WAF rule matching method, see Figure 1 The method comprises the following steps S110 to S150:

[0044] S110, receiving an incoming request from a user;

[0045] S120, extracting various detection position parameters from the incoming request;

[0046] For example, if the incoming request is an http / https request, the detection position parameters can be: "ARGS", "REQUEST_URI", "REQUEST_BODY", "ARGS_NAMES", where "ARGS" contains the request header and the value of the param variable, "REQUEST_URI" contains the request URI, "REQUEST_BODY" refers to the request body, and "ARGS_NAMES" refers to the request header and the name of the param variable. It can be seen that there are four positions in the http / https request to fill in parameters, and these four positions can be filled in with parameters, or parameters can be filled in at some positions.

[0047] For example, for a certain https request, if two of the four positions mentioned above have filled parameters, then these two positions are used as detection position parameters.

[0048] S130, determining the rule sets corresponding to the respective detection position parameters; wherein each detection position parameter corresponds to at least one rule set, each rule set includes at least one first regular matching rule, each first regular matching rule in each rule set corresponds to the same detection position parameter, and each first regular matching rule is a matching rule corresponding to a single detection position parameter;

[0049] That is to say, a rule set is set in advance for each detection position parameter, and this rule set includes at least one first regular matching rule. Each first regular matching rule in this rule set corresponds to the same detection position parameter, and each first regular matching rule is a matching rule corresponding to a single detection position parameter.

[0050] In one embodiment, the process of determining the rule set may include the following steps 1 to 7:

[0051] 1. Obtain a second regular matching rule; wherein the second regular matching rule is a matching rule corresponding to multiple detection position parameters;

[0052] Among them, the second regular matching rule is the original rule, and the original rule is in the form of a multi-position matching rule, that is, a second regular matching rule includes matching rules corresponding to multiple detection position parameters, and there is a logical relationship between the matching rules corresponding to these multiple detection position parameters. For example, a second regular matching rule includes matching rules corresponding to two detection positions, and the logical relationship between the two matching rules is "and", that is, the parameters filled in the corresponding two detection positions in an incoming request are matched with their respective matching rules, and the incoming request is considered to match the second regular matching rule. As long as the parameters filled in one detection position do not match the corresponding matching rule, the incoming request is considered to not match the second regular matching rule.

[0053] 2. Split each of the second regular matching rules to obtain first regular matching rules corresponding to each detection position parameter;

[0054] That is, each second regular matching rule is split to obtain a first regular matching rule corresponding to each detection position parameter, where the first regular matching rule is a matching rule corresponding to a detection position parameter.

[0055] The step of splitting each of the second regular matching rules to obtain first regular matching rules corresponding to each detection position parameter may specifically include:

[0056] 21. When splitting, mark each first regular matching rule from the same second regular matching rule, and record the dependency relationship between each first regular matching rule from the same second regular matching rule;

[0057] For example, the ID of a second regular matching rule is A1, and the IDs of the two first regular matching rules from this second regular matching rule are A1-1 and A1-2 respectively. In this way, the first regular matching rules from the same second regular matching rule can be marked, and the dependency relationship between the two first regular matching rules can be recorded as "&" in a file.

[0058] 22. According to the dependency relationship between the first regular matching rules from the same second regular matching rule, determine the logical relationship between the first regular matching rules from the same second regular matching rule.

[0059] That is, the IDs are integrated according to the interdependent logic in different rule sets to obtain a logical relationship. For example, if the first regular matching rule 1000-1 and the first regular matching rule 1000-2 are both effective, the match is considered successful, and the logical expression is 1000-1&1000-2. If the first regular matching rule 1000-1 and the first regular matching rule 1000-2 are effective at the same time or the first regular matching rule 1000-3 is effective, the match is considered successful, and the corresponding logical expression is 1000&(1002|1003).

[0060] After the logical relationship is formulated, when the rule matching is performed subsequently, whether the matching is successful is determined according to the matching results corresponding to the first regular matching rules having the logical relationship and the logical relationship.

[0061] It is understandable that for the first regular matching rule without dependencies, a single regular matching expression can describe its matching condition. For the rule combination with dependencies, the first regular matching rules in different rule sets need to work together. It is impossible to determine whether the upload request is successfully matched by relying on the above-mentioned single rule set. Therefore, it is necessary to formulate a rule combination to describe the dependencies in the rules.

[0062] 3. Aggregate the first regular matching rules corresponding to the same detection position parameter into a first set;

[0063] That is, the first regular matching rules corresponding to the same detection position parameter are divided into one group. Based on http / https requests, the detection position parameters are: "ARGS", "REQUEST_URI", "REQUEST_BODY", and "ARGS_NAMES". Through this step, four first sets can be obtained. These four first sets correspond to four detection position parameters. This can reduce the number of subsequent rule matching and provide a basis for the concurrent execution of various rule sets.

[0064] It is understandable that the second regular matching rule corresponds to several detection position parameters, and the first regular matching parameters obtained by splitting are placed in several first sets. The first regular matching rules in each first set will not be repeated, and the first regular matching rules in different first sets may be repeated. For example, a second regular matching rule is SecRuleARGS_NAMES|ARGS: / *"@rx\?.+=.+\-\-"\, and this second regular matching rule will be stored in the two first sets of "ARGS_NAMES" and "ARGS" after splitting.

[0065] Among them, after obtaining the first set, it is necessary to assign a unique ID to all the first regular matching rules, and the IDs of the first regular matching rules in different first sets are different.

[0066] Among them, different first regular matching rules in the same first set need to be executed serially, while first regular matching rules in different first sets can be executed in parallel.

[0067] 4. Determine the minimum matching length of the regular expression of each first regular matching rule;

[0068] 5. Divide each first set into multiple second sets according to the minimum matching length of each regular expression of each first regular matching rule; wherein each first regular matching rule in each second set corresponds to the same detection position parameter and the same minimum matching length, and different second sets under one first set correspond to the same detection position parameter and different minimum matching lengths;

[0069] It is understandable that the regular expression in the WAF rule contains static information such as the minimum matching length and matching character features. This information is the original feature of the regular expression itself. By extracting this attribute as a basis for rule division, the rules that do not meet the conditions can be effectively filtered out before matching the parameters. Through static analysis of regular expressions, the minimum matching length of each regular expression is obtained. For example, the minimum matching length of the regular expression "adcc\d+" is 5. If the length of the parameter to be matched is less than 5, it is known that the parameter does not match this regular expression without regular matching.

[0070] Based on the converted 4 first sets, they are divided again according to the minimum matching length. For example, if the minimum matching length is 1, 3, 7, and 15, then each first set will be divided into 4 second sets. In this way, the 4 first sets will be divided into 16 second sets.

[0071] 6. Determine whether the regular expressions of the respective first regular matching rules need to match special characters;

[0072] 7. Divide each second set into a third set and a fourth set according to whether the regular expressions of each first regular matching rule need to match special characters; wherein the third set in each second set includes each first regular matching rule in the second set that needs to match special characters; and the fourth set in each second set includes each first regular matching rule in the second set that does not need to match special characters, and the third set and the fourth set are the rule sets.

[0073] That is to say, through static analysis of regular expressions, we can determine whether special characters need to be matched in regular expressions. For example, for the detection of XSS attacks and SQL injection scripts, special characters that may appear are often included in regular matching expressions. However, there is a small chance that special characters are included in the parameters of http / https requests. In this way, each second set can be divided into two sets: the third set and the fourth set. The third set corresponds to special characters that need to be matched, and the fourth set corresponds to special characters that do not need to be matched. In this way, the 16 second sets will be divided into 16 third sets and 16 fourth sets. These 16 third sets and 16 fourth sets are the rule sets.

[0074] In one embodiment, the determining of the rule sets corresponding to the respective detection position parameters in S130 includes:

[0075] S131, determining the minimum matching length required for the incoming request and whether special characters need to be matched;

[0076] S132. Determine the first set corresponding to each detection position parameter in the incoming request; select the second set corresponding to the minimum matching length required for the incoming request under the first set; and select the third set or the fourth set under the second set according to whether the incoming request needs to match special characters.

[0077] That is, when determining the rule set, it is necessary to determine the minimum matching length in the incoming request and whether special characters need to be matched, and then select the corresponding third set or fourth set.

[0078] S140, performing a matching operation on each detection position parameter in the incoming request with a first regular matching rule in the at least one rule set corresponding to the detection position parameter to obtain a separate matching result for the detection position parameter; and determining a logical processing result of each separate matching result of each detection position parameter according to a logical relationship between each first regular matching rule;

[0079] The logical relationship between each first regular matching rule is determined in advance, and the relevant description is given above.

[0080] It can be seen that each detection position parameter will be matched with the first regular matching rule in the rule set corresponding to the detection position parameter to obtain a separate matching result corresponding to the detection position parameter. Since the first regular matching rules from the same second regular matching rule have a dependency relationship, the logical relationship results of the separate matching results of each detection position parameter are determined based on the logical relationship between the first regular matching rules from the same second regular matching rule.

[0081] In one embodiment, the matching operation described in S140 of each detection position parameter in the incoming request with the first regular matching rule in the at least one rule set corresponding to the detection position parameter to obtain a separate matching result for the detection position parameter may include: executing the matching work corresponding to different rule sets in parallel, and executing the matching work corresponding to each first regular matching rule in the same rule set in serial.

[0082] That is, the matching work of each first regular matching rule in a rule set needs to be executed serially, and the matching work of different rule sets can be executed in parallel.

[0083] S150: Determine a comprehensive matching result according to the logic processing result, and return the comprehensive matching result to the user.

[0084] For example, for a certain https request, two of the four positions above, "ARGS" and "REQUEST_URI", have filled parameters. "ARGS" and "REQUEST_URI" are used as detection position parameters to determine the rule set corresponding to "ARGS" and the rule set corresponding to "REQUEST_URI". The first regular matching rule in the rule set corresponding to "ARGS" is a matching rule set for the position "ARGS", and the rule set corresponding to "REQUEST_URI" is a matching rule set for "REQUEST_URI". The parameters filled in the "ARGS" position in the incoming request are matched with the first regular matching rule in the rule set corresponding to "ARGS", and the parameters filled in the "REQUEST_URI" position in the incoming request are matched with the first regular matching rule in the rule set corresponding to "REQUEST_URI". After matching, two separate matching results can be obtained. Then, based on the logical relationship between the two first regular matching rules that match the parameters "ARGS" and "REQUEST_URI", the logical processing results of the two separate matching results are calculated, and then based on the logical processing results, it is determined whether the user's incoming request matches the WAF rule, that is, a comprehensive matching result is obtained, and then the comprehensive matching result is fed back to the user.

[0085] In one embodiment, the method provided by the embodiment of the present invention may further include:

[0086] S160, recording a matching log of each incoming request; wherein the matching log includes matching parameters carried in the incoming request, matching results obtained after rule matching, and matching times;

[0087] S170, caching the matching logs of each incoming request from the same site, and isolating the caches corresponding to different sites;

[0088] Correspondingly, before extracting each detection location parameter from the incoming request, the method also includes: determining whether there is a matching log corresponding to the same matching parameter in the cache corresponding to the site from which the incoming request received this time comes; if so, returning the matching result in the matching log corresponding to the same matching parameter to the user, and updating the number of matches in the matching log.

[0089] That is to say, the corresponding matching log is recorded after each matching operation, and the incoming requests of each site are cached separately to ensure data security. In this way, after receiving the incoming request, it is first determined whether there is a matching log corresponding to the same matching parameters in the cache corresponding to the site of the incoming request. If there is, the matching result in the matching log corresponding to the same matching parameters is returned to the user, and there is no need to perform subsequent rule matching operations. At the same time, the matching number in the matching log is updated.

[0090] It is understandable that for incoming requests to the same site, the number of requested APIs is limited. For example, the data changes of "ARGS_NAMES" and "REQUEST_URI" are limited. The matching logs after each matching operation of a site are cached, so that the number of rule matches can be greatly reduced when a new incoming request is received later. It can be seen that the high similarity of parameters of requests from the same site is utilized here, and the frequency of cache updates is also reduced. For example, see Table 1 below:

[0091] Table 1

[0092] Fields illustrate Matching parameters The value extracted from the http request for matching Matching results Is the rule matched? Number of matches The number of matches for the same field within a period of time

[0093] In one embodiment, the present invention may further include:

[0094] According to the number of matches in the matching log in the cache corresponding to each site, the matching log in the cache corresponding to the site is eliminated and updated using the least recently used algorithm.

[0095] That is, the cache is updated and maintained using the LRU strategy. The LRU strategy uses the least-matching principle to save frequently hit data and eliminate data that is rarely hit within a period of time.

[0096] It is understandable that the embodiment of the present invention obtains the features of the regular expression in the rule in advance by statically analyzing the rule, namely, the two original feature information of the length of the matching string and whether it contains special characters, and further divides the rule in detail based on this feature, refines the rule set, so that different parameters in the received incoming request can execute different rule sets, greatly reducing the number of rules that need to be traversed, and can improve the WAF rule detection efficiency method. Moreover, a cache of matching logs is built based on the site, so that the next time a request with the same matching parameters is incoming, the rule matching process can be skipped, further improving the detection efficiency.

[0097] The embodiment of the present invention re-integrates the original rules into a new rule set according to the detection position parameters, and different rule sets can be run concurrently.

[0098] It can be seen that the key points involved in the embodiment of the present invention include: splitting the original rules into a set of rules corresponding to a single detection position parameter according to the detection position parameter; obtaining the original feature information of the WAF rule through static analysis of the WAF rule, and further dividing the rule in detail according to this feature, refining the rule set, and filtering out part of the rules when matching parameters through the original feature information, thereby reducing the frequency of rule execution. That is, in order to improve the efficiency of rule matching, the original feature information in the rule is used. This information contains the prerequisites for rule matching, and these prerequisites can be used to accelerate the rule matching process. Since the API contained in the site is fixed, the request parameters of the same site are consistent and repeatable. By adding dynamic caching during the rule execution process, the number of WAF rule executions is reduced. These optimization measures effectively improve the performance and response speed of WAF rules.

[0099] In a second aspect, an embodiment of the present invention provides a WAF rule matching device, see Figure 2 , the device 100 comprises:

[0100] A request receiving module 110, for receiving an incoming request from a user;

[0101] A location extraction module 120, configured to extract various detection location parameters from the incoming request;

[0102] A set determination module 130 is used to determine the rule sets corresponding to the respective detection position parameters; wherein each detection position parameter corresponds to at least one rule set, each rule set includes at least one first regular matching rule, each first regular matching rule in each rule set corresponds to the same detection position parameter, and each first regular matching rule is a matching rule corresponding to a single detection position parameter;

[0103] The rule matching module 140 is used to match each detection position parameter in the incoming request with the first regular matching rule in the at least one rule set corresponding to the detection position parameter to obtain a separate matching result of the detection position parameter; and determine the logical processing result of each separate matching result of each detection position parameter according to the logical relationship between each first regular matching rule;

[0104] The result returning module 150 is used to determine a comprehensive matching result according to the logic processing result, and return the comprehensive matching result to the user.

[0105] In one embodiment, the apparatus further comprises:

[0106] A rule determination module is used to: obtain a second regular matching rule; wherein the second regular matching rule is a matching rule corresponding to multiple detection position parameters; split each of the second regular matching rules to obtain the first regular matching rules corresponding to each detection position parameter; aggregate the first regular matching rules corresponding to the same detection position parameter into a first set; determine the minimum matching length of the regular expression of each first regular matching rule; divide each first set into multiple second sets according to the minimum matching length of the regular expression of each first regular matching rule; wherein each first regular matching rule in each second set corresponds to the same detection position parameter and the same minimum matching length, different second sets under a first set correspond to the same detection position parameter and different minimum matching lengths; determine whether the regular expressions of each first regular matching rule need to match special characters; divide each second set into a third set and a fourth set according to whether the regular expressions of each first regular matching rule need to match special characters; wherein the third set in each second set includes each first regular matching rule in the second set that needs to match special characters; the fourth set in each second set includes each first regular matching rule in the second set that does not need to match special characters, and the third set and the fourth set are the rule sets.

[0107] In one embodiment, the rule determination module for determining the rule sets corresponding to the respective detection position parameters includes: determining the minimum matching length required for the incoming request and whether special characters need to be matched; determining the first set corresponding to the respective detection position parameters in the incoming request; selecting the second set corresponding to the minimum matching length required for the incoming request under the first set; and selecting the third set or the fourth set under the second set according to whether the incoming request needs to match special characters.

[0108] In one embodiment, the rule determination module splits each of the second regular matching rules to obtain the first regular matching rules corresponding to each detection position parameter, including: marking each first regular matching rule from the same second regular matching rule during the splitting, and recording the dependency relationship between each first regular matching rule from the same second regular matching rule; determining the logical relationship between each first regular matching rule from the same second regular matching rule based on the dependency relationship between each first regular matching rule from the same second regular matching rule.

[0109] In one embodiment, the rule matching module is specifically used to: execute matching tasks corresponding to different rule sets in parallel, and execute matching tasks corresponding to each first regular matching rule in the same rule set in series.

[0110] In one embodiment, the apparatus further comprises:

[0111] A log recording module, used to record the matching log of each incoming request; wherein the matching log includes the matching parameters carried in the incoming request, the matching results obtained after the rule matching, and the number of matches;

[0112] The log cache module is used to cache the matching logs of each incoming request from the same site, and isolate the caches corresponding to different sites;

[0113] Correspondingly, before extracting each detection location parameter from the incoming request, the location extraction module is also used to: determine whether there is a matching log corresponding to the same matching parameters in the cache corresponding to the site from which the incoming request received this time comes; if so, return the matching result in the matching log corresponding to the same matching parameters to the user, and update the number of matches in the matching log.

[0114] In one embodiment, the apparatus further comprises:

[0115] The log update module is used to eliminate and update the matching log in the cache corresponding to each site using the least recently used algorithm according to the number of matches in the matching log in the cache corresponding to the site.

[0116] It is understandable that the explanation, specific implementation, beneficial effects, examples, etc. of the relevant contents in the device provided in the embodiment of the present invention can be found in the corresponding parts of the method provided in the first aspect, and will not be repeated here.

[0117] In a third aspect, an embodiment of the present invention provides a computer-readable medium, on which computer instructions are stored. When the computer instructions are executed by a processor, the processor executes the method provided in the first aspect.

[0118] Specifically, a system or device equipped with a storage medium can be provided, on which software program code that implements the functions of any of the above-mentioned embodiments is stored, and a computer (or CPU or MPU) of the system or device can read and execute the program code stored in the storage medium.

[0119] In this case, the program code itself read from the storage medium can realize the function of any one of the above-mentioned embodiments, and thus the program code and the storage medium storing the program code constitute a part of the present invention.

[0120] The storage medium embodiments for providing the program code include a floppy disk, a hard disk, a magneto-optical disk, an optical disk (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), a magnetic tape, a non-volatile memory card, and a ROM. Alternatively, the program code can be downloaded from a server computer by a communication network.

[0121] In addition, it should be clear that the functions of any of the above embodiments can be implemented not only by executing the program code read by the computer, but also by enabling an operating system operating on the computer to complete part or all of the actual operations based on instructions from the program code.

[0122] In addition, it can be understood that the program code read from the storage medium is written to a memory provided in an expansion board inserted into the computer or to a memory provided in an expansion module connected to the computer, and then based on the instructions of the program code, a CPU installed on the expansion board or expansion module is enabled to perform part or all of the actual operations, thereby realizing the functions of any of the above-mentioned embodiments.

[0123] It is understandable that the explanation, specific implementation methods, beneficial effects, examples, etc. of the relevant contents in the computer-readable medium provided in the embodiment of the present invention can be found in the corresponding parts of the method provided in the first aspect, and will not be repeated here.

[0124] In a fourth aspect, an embodiment of the present specification provides a computing device, including a memory and a processor, wherein the memory stores executable code, and when the processor executes the executable code, it implements the method in any embodiment of the specification.

[0125] It is understandable that the explanation, specific implementation, beneficial effects, examples, etc. of the relevant contents in the computing device provided in the embodiment of the present invention can be found in the corresponding parts of the method provided in the first aspect, and will not be repeated here.

[0126] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0127] Those skilled in the art should be aware that in one or more of the above examples, the functions described in the present invention can be implemented by hardware, software, widgets, or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0128] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solution of the present invention should be included in the scope of protection of the present invention.

Claims

1. A WAF rule matching method, characterized in that: include: Receive incoming requests from users; extracting respective detection position parameters from the incoming request; Determine the rule sets corresponding to the respective detection position parameters; wherein each detection position parameter corresponds to at least one rule set, each rule set includes at least one first regular matching rule, each first regular matching rule in each rule set corresponds to the same detection position parameter, and each first regular matching rule is a matching rule corresponding to a single detection position parameter; Performing a matching operation on each detection position parameter in the incoming request with a first regular matching rule in the at least one rule set corresponding to the detection position parameter to obtain a separate matching result for the detection position parameter; and determining a logical processing result of each separate matching result of each detection position parameter according to a logical relationship between each first regular matching rule; A comprehensive matching result is determined according to the logic processing result, and the comprehensive matching result is returned to the user.

2. The method according to claim 1, characterized in that: The process of determining the rule set includes: Obtain a second regular matching rule; wherein the second regular matching rule is a matching rule corresponding to multiple detection position parameters; Splitting each of the second regular matching rules to obtain first regular matching rules corresponding to each detection position parameter; Aggregate first regular matching rules corresponding to the same detection position parameter into a first set; Determine the minimum matching length of the regular expression of each first regular matching rule; According to the minimum matching length of each regular expression of each first regular matching rule, each first set is divided into multiple second sets; wherein each first regular matching rule in each second set corresponds to the same detection position parameter and the same minimum matching length, and different second sets under one first set correspond to the same detection position parameter and different minimum matching lengths; Determine whether the regular expression of each first regular matching rule needs to match special characters; According to whether the regular expressions of each first regular matching rule need to match special characters, each second set is divided into a third set and a fourth set; wherein the third set in each second set includes each first regular matching rule in the second set that needs to match special characters; and the fourth set in each second set includes each first regular matching rule in the second set that does not need to match special characters, and the third set and the fourth set are the rule sets.

3. The method according to claim 2, characterized in that The determining of the rule sets corresponding to the respective detection position parameters includes: Determining the minimum matching length required for the incoming request and whether special characters need to be matched; Determine a first set corresponding to each detection position parameter in the incoming request; select a second set corresponding to the minimum matching length required for the incoming request under the first set; and select the third set or the fourth set under the second set according to whether the incoming request needs to match special characters.

4. The method according to claim 2, characterized in that: The step of splitting each of the second regular matching rules to obtain first regular matching rules corresponding to each detection position parameter includes: When splitting, each first regular matching rule from the same second regular matching rule is marked, and the dependency relationship between each first regular matching rule from the same second regular matching rule is recorded; According to the dependency relationship between the first regular matching rules from the same second regular matching rule, a logical relationship between the first regular matching rules from the same second regular matching rule is determined.

5. The method according to claim 1, characterized in that The matching operation of each detection position parameter in the incoming request with the first regular matching rule in the at least one rule set corresponding to the detection position parameter to obtain a separate matching result of the detection position parameter includes: The matching tasks corresponding to different rule sets are executed in parallel, and the matching tasks corresponding to the first regular matching rules in the same rule set are executed in series.

6. The method according to claim 1, characterized in that Also includes: Record the matching log of each incoming request; wherein the matching log includes the matching parameters carried in the incoming request, the matching results obtained after the rule matching, and the number of matches; Cache the matching logs of each incoming request from the same site, and isolate the caches corresponding to different sites; Correspondingly, before extracting each detection location parameter from the incoming request, the method also includes: determining whether there is a matching log corresponding to the same matching parameter in the cache corresponding to the site from which the incoming request received this time comes; if so, returning the matching result in the matching log corresponding to the same matching parameter to the user, and updating the number of matches in the matching log.

7. The method according to claim 6, characterized in that Also includes: According to the number of matches in the matching log in the cache corresponding to each site, the matching log in the cache corresponding to the site is eliminated and updated using the least recently used algorithm.

8. A WAF rule matching device, characterized in that: include: A request receiving module, used to receive incoming requests from users; A location extraction module, used to extract various detection location parameters from the incoming request; A set determination module, used to determine the rule sets corresponding to the respective detection position parameters; wherein each detection position parameter corresponds to at least one rule set, each rule set includes at least one first regular matching rule, each first regular matching rule in each rule set corresponds to the same detection position parameter, and each first regular matching rule is a matching rule corresponding to a single detection position parameter; A rule matching module, used for matching each detection position parameter in the incoming request with a first regular matching rule in the at least one rule set corresponding to the detection position parameter to obtain a separate matching result of the detection position parameter; and determining a logical processing result of each separate matching result of each detection position parameter according to a logical relationship between each first regular matching rule; The result returning module is used to determine the comprehensive matching result according to the logic processing result, and return the comprehensive matching result to the user.

9. A computer-readable storage medium, characterized in that: A computer program is stored thereon, and when the computer program is executed in a computer, the computer is caused to execute the method according to any one of claims 1 to 7.

10. A computing device, characterized in that The method comprises a memory and a processor, wherein the memory stores executable codes, and when the processor executes the executable codes, the method according to any one of claims 1 to 7 is implemented.

Images